Skip to content

Public Release Checklist

These docs describe the reviewed public component set. They do not assert that tagged packages have already been published or that the full bundle currently resolves from a public package index.

Documentation and package checks

  • Run strict builds and local-link/anchor checks. Verify rendered pages, search indexes, and assets in wheels, and rebuild from source distributions.
  • Run lightweight tutorials and validate the supplied scientific templates against the intended public plugin versions. Record external-engine validation separately.
  • Review examples, screenshots, scientific data provenance, and repository history before exposing an existing repository. A clean current tree does not clean history.
  • Set public repository/site URLs and monitored support and security-reporting routes.
  • Add reviewed contributor/community policies to public package repositories.

Deferred GUI security work

The focused GUI security fix remains a follow-up: apply authentication consistently to plugin extension routes, support authenticated browser requests, and ensure uploaded filenames cannot escape their staging directory. Validate these together before exposing the GUI to untrusted clients.

Licensing and distribution prerequisites

Package metadata declares MIT, and each package includes the project license text. The GUI ships React's full notice and MIT text. The docs ship the third-party notices and full licence texts with the site; unused language-search libraries are excluded from the English site. MD retains the vendored OpenBPMD notice and licence. Preserve these notices and review them when dependencies or generated assets change. Model weights and scientific data remain subject to their own terms; the project licence does not replace those terms.

The edited QM and docking sources use the published maintained distributions caddforge-opencosmors==0.0.1 and caddforge-unidock-tools==1.1.3, respectively, replacing the previous direct Git dependencies. PyOCL is published as pyocl-idor; the edited component sources require pyocl-idor>=0.8.3 and Java 21 or newer. Python imports remain pyocl. The inherited CADDForge releases do not contain these dependency changes. Release updated components and test the resulting bundle pins against public indexes. Verify the full installation before enabling package publication. Create the public release repositories, record reviewed commits, and create release tags once the packages are clean. Update the version matrix with those actual versions, commits, tags, and publication status; a Git tag is not evidence of a published package.

The current matrix records all nine new public component tags and separately verified package-index availability. MD publication remains pending as of 2026-10-15. Documentation 0.3.0 has source tag v0.3.0 and awaits publication. The bundle still needs a new unused version, release commit, and tag; do not publish its edited sources under the inherited version. Update and test the bundle pins, including caddforge-docs==0.3.0, once all required component distributions are available.

The bundle remains in its 0.x initial development series. Reserve 1.0.0 for a future stable API commitment; the bundle and components have independent version sequences.

Release core, then GUI before FEP and docking, then descriptors and docking before MD. Publish data science before docs, and publish the bundle last with exact tested pins. The bundle includes docs as a default dependency; the docs wheel must be available on the chosen package index before that bundle is installed. Component versions remain independent. Update documented versions and migration instructions with each release. Before pushing a release tag, configure the project's PyPI Trusted Publisher for release.yml and the pypi environment. Pushing a matching v* tag publishes after validation; ordinary documentation changes and manual runs do not publish. Site deployment remains separately opt-in.